Higher order logic applied to expert systems for alarm analysis, filtering, correlation and root cause

• US 8,027,946 B1
• Filed: 12/21/2007
• Issued: 09/27/2011
• Est. Priority Date: 12/22/2006
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Gentle, Christopher R., Kawahara, Lisa Y., Maity, Ashis Kumar, Daily, Daniel J., Thomas, Michael J.
• Primary Examiner(s): VINCENT, DAVID ROBERT
• Application Number:
  US11/962,799
• Time in Patent Office: 1,376 Days
• Field of Search: 706/20, 706 45- 47, 706 55- 59
• US Class Current: 706/47
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound

Abstract

The present invention is directed to a system and method for applying second- and higher-order logic to analysis of event descriptive information, such as alarms, error messages, and fault signals.

Claims

1. A method, comprising:

receiving, from a network element, event descriptive information, the event descriptive information describing an event involving at least one of a state, status, condition, configuration, operation, function, type, identity, and activity of the network element;

analyzing, by at least one of second-order and higher-order logic statements and by computer, the received event descriptive information to determine at least one of (i) a causal event underlying the event described by the event descriptive information and (ii) a remedial action to respond to the event described by the event descriptive information, wherein the analyzing step comprises the sub-steps;

selecting, by a many-order logic module, a lower-order logic module to analyze the event descriptive information;

providing the event descriptive information to the selected lower-order logic module;

analyzing, by the selected lower-order logic module, the event descriptive information to determine the at least one of (i) a causal event underlying the event described by the event descriptive information and (ii) a remedial action to respond to the event described by the event descriptive information; and

outputting, by computer, the at least one of (i) a causal event underlying the event described by the event descriptive information and (ii) a remedial action to respond to the event described by the event descriptive information.

2. The method of claim 1, wherein at least one of (i) an event described by the event descriptive information, (ii) a causal event underlying the event described by the event descriptive information, and (iii) a remedial action to respond to the event described by the event descriptive information is at least one of (i) presented by a graphical user interface to a user, (ii) stored in a tangible computer media, and (iii) used to generate control signals to the network element, and wherein the network element is at least one of a gateway, router, server, voice communication device, text communication device, switch, and software module and further comprising:

parsing, by a meta-parser system, the received event descriptive information, wherein the parsed received event descriptive information is analyzed in the analyzing step.

3. The method of claim 2, further comprising:

determining, by the many-order logic module, that a lower-order logic module currently does not exist to analyze the event descriptive information; and

in response, creating, by a lower-order module generator, a lower-order module to analyze the event descriptive information.

4. The method of claim 3, wherein the creating step comprises the sub-steps:

providing a specification proof describing at least one of (i) a state and/or configuration and (ii) a condition, operation, and function, of the network element;

converting at least one of the specification proof and a modified form thereof to a programming language; and

converting the programming language into program code describing the lower-order module.

5. The method of claim 4, further comprising:

providing the specification proof to a core inference engine;

producing, by the core inference engine, the modified form of specification proof, wherein the modified form of the specification proof is converted into the programming language.

6. A non-transitory computer readable medium comprising processor-executable instructions adapted to perform the steps of claim 1.

7. A system, comprising:

a memory;

a processor in communication with the memory, the processor adapted to execute modules, the modules comprising;

an input adapted to receive, from a network element, event descriptive information, the event descriptive information describing an event involving at least one of a state, status, condition, configuration, operation, function, type, identity, and activity of the network element, wherein the network element is at least one of a gateway, router, server, voice communication device, text communication device, switch, and software module;

a meta-parser system adapted to parse event descriptive information, wherein the parsed received event descriptive information is analyzed by a lower-order module;

a plurality of lower-order logic modules adapted to analyze event descriptive information and determine at least one of (i) an event described by the event descriptive information, (ii) a causal event underlying the event described by the event descriptive information, and (iii) a remedial action to respond to the event described by the event descriptive information

a many-order logic module adapted to select, by at least one of second-order and higher-order logic statements, a lower-order logic module to analyze selected event descriptive information to determine at least one of (i) an event described by the selected event descriptive information, (ii) a causal event underlying the event described by the selected event descriptive information, and (iii) a remedial action to respond to the event described by the selected event descriptive information; and

an interface adapted to output the at least one of (i) an event described by the event descriptive information, (ii) a causal event underlying the event described by the event descriptive information, and (iii) a remedial action to respond to the event described by the event descriptive information.

8. The system of claim 7, wherein the many-order logic module is adapted to determine that a lower-order logic module currently does not exist to analyze the selected event descriptive information and, in response, request creation of a lower-order logic module, and further comprising:

a lower-order module generator adapted to create the lower-order logic module to analyze the selected event descriptive information.

9. The system of claim 8, wherein the lower-order module generator is adapted to:

receive a specification proof describing at least one of (i) a state and/or configuration and (ii) a condition, operation, and/or function of the network element;

convert at least one of the specification proof and a modified form thereof to a programming language; and

convert the programming language into program code describing the lower-order module.

10. The system of claim 8, further comprising:

a core inference engine adapted to receive a specification proof and produce the modified form of the specification proof, wherein the modified form of the specification proof is converted into the programming language.